From 396428152413f431cac18f68a7190827b4acb3b6 Mon Sep 17 00:00:00 2001 From: Michael Haggerty Date: Fri, 8 Sep 2017 18:10:10 +0200 Subject: load_subtree(): check that `prefix_len` is in the expected range This value, which is stashed in the last byte of an object_id hash, gets handed around a lot. So add a sanity check before using it in `load_subtree()`. Signed-off-by: Michael Haggerty Signed-off-by: Junio C Hamano --- notes.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/notes.c b/notes.c index 40d9ba6252..27d232f294 100644 --- a/notes.c +++ b/notes.c @@ -417,7 +417,10 @@ static void load_subtree(struct notes_tree *t, struct leaf_node *subtree, oid_to_hex(&subtree->val_oid)); prefix_len = subtree->key_oid.hash[KEY_INDEX]; - assert(prefix_len * 2 >= n); + if (prefix_len >= GIT_SHA1_RAWSZ) + BUG("prefix_len (%"PRIuMAX") is out of range", (uintmax_t)prefix_len); + if (prefix_len * 2 < n) + BUG("prefix_len (%"PRIuMAX") is too small", (uintmax_t)prefix_len); memcpy(object_oid.hash, subtree->key_oid.hash, prefix_len); while (tree_entry(&desc, &entry)) { unsigned char type; -- cgit v1.2.3